Date: Tue, 21 Feb 2017 14:40:02 +0000 From: Alexey Dokuchaev <danfe@FreeBSD.org> To: Eric Badger <badger@FreeBSD.org> Cc: Bartek Rutkowski <robak@FreeBSD.org>, src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r314036 - head/usr.sbin/bsdinstall/scripts Message-ID: <20170221144002.GA87822@FreeBSD.org> In-Reply-To: <28a4cf5e-2edd-3e30-9ecd-817f886e9ea3@FreeBSD.org> References: <201702210937.v1L9bY6V093836@repo.freebsd.org> <28a4cf5e-2edd-3e30-9ecd-817f886e9ea3@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Feb 21, 2017 at 08:34:29AM -0600, Eric Badger wrote: > Thanks for working on making it easier to harden FreeBSD. While > defaulting some of these options to "on" seem pretty harmless (e.g. > random_pid), others are likely to cause confusion for new and > experienced users alike (e.g. proc_debug. I've never used that option > before, so I gave it a try. It simply causes gdb to hang when attempting > to start a process, with no obvious indication of why). I concur. In fact, harmless knobs should probably be turned on by default in FreeBSD itself (i.e., without any "hardening" help from the installer), while more intrusive ones should be opt-in, not opt-out. ./danfe
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20170221144002.GA87822>